Malicious code in ladash-cli (npm)
ladash-cli is a typosquat package on npm that executes malicious code during installation. The postinstall script downloads and executes a Windows binary, with special handling for WSL environments to compromise the underlying Windows host.
- Disclosed
- Last updated
- Blast radius
- Any developer or system that installed ladash-cli from npm
- Ecosystems
- Attack vectors
- Affected entities
- ladash-cliTyposquat of lodash-cli
ladash-cli is a one-character typosquat of the legitimate lodash-cli package. The malicious package exports an empty object as its main entry point, with all functional code contained in scripts/postinstall.js, which executes during npm install.
The postinstall script XOR-decodes (using key 'stf2026') a hidden URL pointing to https://github.com/bebraz1/qPzM50V1AKG0rVlH/releases/download/null/main.exe, downloads the executable to %TEMP%\main.exe, and spawns it with detached stdio and hidden window on Windows hosts. The script also includes WSL detection logic that inspects /proc/version and /proc/sys/kernel/osrelease for 'microsoft' or 'WSL' strings, and if matched, decodes and executes a PowerShell bridge command to deliver the same Windows executable to the underlying Windows host from a Linux-WSL installation.
Additionally, the postinstall unconditionally sends a JSON platform beacon to http://193.70.34.101:20099/vote over plain HTTP. All malicious payloads (download URL, PowerShell command, and byte arrays) are stored as XOR-encoded data with no hash or signature verification. The GitHub account hosting the binary is unrelated to any official lodash publisher.
The incident was identified and credited to the OpenSSF malicious-packages project.
Indicators of compromise
- Packages
- ladash-cli
- Domains
- github.com/bebraz1/qPzM50V1AKG0rVlH
- IPs
- 193.70.34.101
- Hashes
- 8d1b70674c7273e350d033cacec46a4981aebced798342e3b28da3dcd52a34bb
Remediation
- Immediately uninstall ladash-cli from all systems
- Audit npm install logs to identify affected machines and installation timestamps
- Scan affected systems for the presence of main.exe in %TEMP% and any spawned child processes
- Review network logs for connections to 193.70.34.101:20099 and the GitHub release URL
- If WSL is in use, inspect PowerShell execution logs for suspicious bridge commands
- Update npm to the latest version and use npm audit to detect similar typosquats
- Consider using npm package name verification tools and dependency scanning in CI/CD pipelines
- Block the malicious IP 193.70.34.101 and GitHub release URL at network perimeter if applicable
Sources
- GitHub Advisory GHSA-47qr-6823-p4p3 · GitHub Advisory Database
Cite this entry
"Malicious code in ladash-cli (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 19, 2026; last updated August 19, 2026. https://supplychainattack.org/incident/malicious-code-in-ladash-cli-npm-4r7ywf
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in create-coin (npm)
create-coin@20.1.1 on npm contained malicious postinstall code that collected sensitive environment variables, credentials, and host reconnaissance data. The package impersonated an esbuild platform build and exfiltrated data to a hardcoded endpoint.
npmCompromised packageTyposquatting - containedcritical
Malicious code in chai-as-testkit (npm)
The npm package chai-as-testkit is a typosquat/impersonation attack delivering obfuscated malicious code that executes on import. The package falsely claims to be a vulnerability management tool but ships pino library files under a different author, with a synthetic stub that loads a 4MB+ obfuscated bundle containing attacker-controlled code.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in @next-fonts/font (npm)
@next-fonts/font is a typosquat package on npm that executes arbitrary attacker-controlled code via a blockchain-mediated C2 channel when its Inter() function is called. The malicious payload is base64-encoded and executed through Node.js spawn or eval, with no legitimate font functionality.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in chai-as-soul (npm)
chai-as-soul@2.3.5 is a typosquat of the pino logging library containing malicious code that exfiltrates environment variables (including AWS/GCP/CI tokens) and executes arbitrary remote code on installation.
npmTyposquattingCompromised package